39688: Skip out of P_EXACTLY pattern loop if P_PURES.

If it's really a pure string, there's only one exact match.  We could
overwrite the next pointer; usually this didn't matter because
we'd hit a termination, but if we reallocated we might be looking
at garbage.

2 files changed, 5 insertions, 2 deletions

diff --git a/ChangeLog b/ChangeLog
index e7c7c8b07..bbe5f7590 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,5 +1,8 @@
 2016-10-20  Peter Stephenson  <p.stephenson@samsung.com>
 
+	* 39688: Src/pattern.c: Alternative fix: next pointer is
+	irrelevant anyway as there's only one P_EXACTLY in a P_PURES.
+
 	* 39683: Src/pattern.c: Update scan pointer in pattern after
 	possible reallocation for meta handling.
 
diff --git a/Src/pattern.c b/Src/pattern.c
index 158bfd560..1f2e94bd9 100644
--- a/Src/pattern.c
+++ b/Src/pattern.c
@@ -677,8 +677,6 @@ patcompile(char *exp, int inflags, char **endexp)
 			    p = (Patprog)patout;
 			    pd = patout - oldpatout;
 			    opnd += pd;
-			    pscan += pd;
-			    next += pd;
 			    dst = patout + startoff;
 			}
 
@@ -690,6 +688,8 @@ patcompile(char *exp, int inflags, char **endexp)
 				*dst++ = *opnd++;
 			    }
 			}
+			/* Only one string in a PAT_PURES, so now done. */
+			break;
 		    }
 		}
 		p->size = dst - patout;